CCNA Org Complexity Questions — Page 5 of 6

301

MCQmedium

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

A.The bucket policy denies access from all accounts except 123456789012.

B.The bucket policy only grants access to the root user of account 123456789012, not to other accounts.

C.The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.

D.The request is not signed, so it is denied by the aws:SecureTransport condition.

AnswerB

The Principal is set to the root user of the bucket owner account.

Why this answer

The bucket policy in the exhibit uses a Principal element of `"AWS": "arn:aws:iam::123456789012:root"`. This grants access only to the root user of account 123456789012, not to any IAM users or roles in that account, and certainly not to any principals in account 111111111111. When the developer from account 111111111111 attempts to access the object with a signed request (no --no-sign-request), the request is signed with credentials from that account, which are not listed in the Principal, so S3 denies the request.

Exam trap

The trap here is that candidates often confuse the `aws:SecureTransport` condition with request signing, or assume that a bucket policy that grants access to one account's root user automatically allows all IAM users in that account, when in fact it only allows the root user itself.

How to eliminate wrong answers

Option A is wrong because the bucket policy does not explicitly deny access from other accounts; it simply grants access only to the root user of account 123456789012, which implicitly denies all others by default. Option C is wrong because the question states the developer uses the AWS CLI without --no-sign-request, meaning the request is signed, and there is no indication that HTTPS is not used; the `aws:SecureTransport` condition would only deny if the request were over HTTP, which is not stated. Option D is wrong because the request is signed (no --no-sign-request), so it is not an unsigned request; the `aws:SecureTransport` condition checks for HTTPS, not for signing, and the failure is due to the Principal restriction, not transport security.

Practice this question →

302

MCQmedium

A company has a multi-account AWS environment with over 500 accounts. The security team uses AWS Config to evaluate resource compliance across all accounts. They have set up an AWS Config aggregator in the security account to collect configuration snapshots from all member accounts. Recently, the team noticed that some member accounts are not showing up in the aggregator. The accounts are active and have AWS Config enabled. What should the security team do to troubleshoot this issue?

A.Ensure that the member accounts have enabled AWS Config in the same region as the aggregator.

B.Check if the member accounts have exceeded the AWS Config resource limits.

C.Check if the AWS Config recorder in the member accounts is configured to record all resource types.

D.Verify that the AWS Config aggregator in the security account has the correct authorization to assume a role in each member account.

AnswerD

The aggregator needs cross-account IAM roles to retrieve data; if permissions are missing or incorrect, accounts won't appear.

Why this answer

AWS Config aggregators require cross-account authorization to collect configuration data from member accounts. Even if AWS Config is enabled in member accounts, the aggregator in the security account must have the correct IAM role permissions (via an IAM role in each member account) to assume and retrieve configuration snapshots. Without this authorization, the aggregator cannot access the member accounts' data, causing them to not appear.

Exam trap

The trap here is that candidates assume enabling AWS Config in member accounts is sufficient, overlooking the critical cross-account authorization step required by the aggregator to pull data from those accounts.

How to eliminate wrong answers

Option A is wrong because AWS Config aggregators can collect data from multiple regions, and the issue is about accounts not showing up, not regions; the aggregator can aggregate across regions if configured correctly. Option B is wrong because exceeding AWS Config resource limits would cause errors or throttling, not a complete absence of accounts in the aggregator; the accounts are active and Config is enabled, so limits are not the likely cause. Option C is wrong because the AWS Config recorder configuration (recording all resource types or specific ones) affects what resources are recorded, not whether the account appears in the aggregator; the aggregator shows accounts regardless of the recorder's scope.

Practice this question →

303

MCQmedium

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

A.Configure CloudWatch Events cross-account to forward logs to a central S3 bucket.

B.Create an organization trail in the management account that delivers logs to the central S3 bucket in the audit account, and set the bucket policy to allow CloudTrail from the organization.

C.Use AWS Organizations to automatically create a CloudTrail trail in the management account that logs all accounts.

D.Create a CloudTrail trail in each account that delivers logs to the central S3 bucket, with a bucket policy that grants write access to each account's CloudTrail service.

AnswerB

An organization trail automatically collects logs from all accounts and can deliver to a bucket in a different account if the bucket policy permits.

Why this answer

AWS Organizations allows you to create an organization trail in the management account that automatically applies to all accounts in the organization. By configuring the trail to deliver logs to a central S3 bucket in the audit account, and setting the bucket policy to grant CloudTrail service access from the organization, you centralize logging without needing per-account trails. This approach ensures that new accounts added to the organization are automatically covered.

Exam trap

The trap here is that candidates often assume they must create individual trails per account (Option D) or use CloudWatch Events (Option A), missing the simpler and more robust organization trail feature that automatically covers all accounts in the organization.

How to eliminate wrong answers

Option A is wrong because CloudWatch Events cross-account forwarding is not designed to aggregate CloudTrail logs into S3; it forwards events to targets like Lambda or SQS, not directly to S3, and would require custom processing. Option C is wrong because AWS Organizations does not automatically create a CloudTrail trail; you must explicitly create an organization trail in the management account. Option D is wrong because while it could work technically, it is not the simplest or most scalable solution; it requires configuring a trail in every account and managing individual bucket policies, which does not leverage the organizational trail feature that automatically includes all accounts.

Practice this question →

304

MCQeasy

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

A.Use AWS Direct Connect to connect all VPCs to a central on-premises firewall.

B.Use a Network Load Balancer in each VPC to forward traffic to a firewall instance.

C.Attach all VPCs to a Transit Gateway and route traffic through a central inspection VPC.

D.Create VPC peering connections between all VPCs and route traffic through a security VPC.

AnswerC

Transit Gateway enables transitive routing with a central inspection VPC.

Why this answer

AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs attach to a central Transit Gateway, and a dedicated inspection VPC (with the security appliance) acts as the central inspection point. By configuring route tables in the Transit Gateway to route all inter-VPC traffic through the inspection VPC, you achieve mandatory traffic inspection without complex peering or performance bottlenecks.

Exam trap

The trap here is that candidates may assume VPC peering is simpler or more direct, but they overlook that VPC peering lacks transitive routing, making it impossible to force all inter-VPC traffic through a single inspection point without a full mesh and complex routing.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection to on-premises, not a mechanism to connect VPCs to each other or to a central firewall; it would introduce unnecessary latency and dependency on on-premises infrastructure for VPC-to-VPC traffic. Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot inspect or forward traffic for security purposes; it is designed for load balancing, not traffic inspection or routing. Option D is wrong because VPC peering does not support transitive routing, so you would need a full mesh of peering connections (which does not scale) and still cannot force all traffic through a central inspection VPC without complex routing and additional appliances.

Practice this question →

305

MCQhard

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

A.Use AWS Single Sign-On (SSO) to grant the audit team access to each account.

B.Create an IAM user in the audit account and allow that user to assume a role in each account.

C.Manually create an IAM role in each account and attach a read-only policy.

D.Use AWS CloudFormation StackSets to deploy a stack containing an IAM role with the required trust and permissions.

AnswerD

StackSets can deploy to all accounts in an organization automatically.

Why this answer

AWS CloudFormation StackSets allows you to deploy a consistent IAM role with a read-only policy and a trust policy that grants the audit account access across all target accounts in a single, automated, and scalable operation. This approach eliminates manual effort, ensures consistency, and scales to hundreds of accounts without requiring per-account configuration.

Exam trap

The trap here is that candidates often choose manual role creation (Option C) because it seems straightforward, but they overlook the scalability and automation benefits of StackSets, which is the most efficient solution for managing cross-account roles across many accounts in a multi-account strategy.

How to eliminate wrong answers

Option A is wrong because AWS Single Sign-On (SSO) is designed for federated user access to the AWS Management Console and does not provide a mechanism to grant programmatic cross-account IAM role access for a dedicated audit account; it also does not natively enforce read-only permissions across all resources. Option B is wrong because creating an IAM user in the audit account and allowing that user to assume roles in each account is not scalable—it requires manual creation of roles and trust policies in every account, and IAM users are a security anti-pattern for cross-account access compared to role-based access. Option C is wrong because manually creating an IAM role in each account with a read-only policy is not scalable for a multi-account environment with many accounts; it introduces human error, inconsistency, and operational overhead.

Practice this question →

306

MCQhard

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

A.The subnet's auto-assign public IP setting is disabled

B.The internet gateway is not attached to the VPC

C.The subnet needs a NAT gateway for internet access

D.The subnet's route table does not have a route to the internet gateway

AnswerA

MapPublicIpOnLaunch is false, so instances lack public IPs.

Why this answer

The most likely cause is that the subnet's auto-assign public IP setting is disabled. Even though the subnet has a default route (0.0.0.0/0) pointing to an internet gateway, EC2 instances launched in that subnet will not receive a public IP address automatically unless the subnet's 'Auto-assign public IPv4 address' setting is enabled. Without a public IP (or an Elastic IP), the instance cannot communicate with the internet through the internet gateway, as the internet gateway requires a public IP for return traffic routing.

Exam trap

The trap here is that candidates often assume a route to an internet gateway is sufficient for internet access, overlooking the requirement that the instance must have a public IP address for the internet gateway to route traffic correctly.

How to eliminate wrong answers

Option B is wrong because the question explicitly states the VPC has an internet gateway attached, so this is not the issue. Option C is wrong because a NAT gateway is only needed for private subnets to access the internet; this subnet has a route to an internet gateway, indicating it is intended to be a public subnet, and a NAT gateway would not solve the lack of a public IP. Option D is wrong because the question states the route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway, so the route is present.

Practice this question →

307

MCQeasy

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

A.Create separate AWS accounts for each project and use consolidated billing to view costs.

B.Use AWS Budgets with cost allocation tags to track project costs.

C.Apply cost allocation tags to resources in each account and use AWS Cost Explorer to filter by tag.

D.Use AWS Cost Categories in AWS Cost Explorer to group costs by shared tags that are activated centrally.

AnswerD

Cost Categories allow grouping by tags, accounts, or services and are managed centrally in the management account.

Why this answer

AWS Cost Categories allow you to group costs based on shared tags, accounts, or other dimensions across multiple accounts in an AWS Organization. This is the most scalable approach for tracking costs by project when resources span multiple accounts, as it centralizes cost allocation without requiring manual tag activation per account.

Exam trap

The trap here is that candidates often confuse cost allocation tags (which require per-account activation) with AWS Cost Categories (which provide centralized grouping), leading them to choose Option C as a simpler but less scalable solution.

How to eliminate wrong answers

Option A is wrong because creating separate accounts per project is not scalable for many projects and does not inherently allocate costs by project—it only provides account-level cost visibility. Option B is wrong because AWS Budgets are for setting spending limits and alerts, not for tracking or allocating costs retroactively by project. Option C is wrong because cost allocation tags must be activated individually in each account's billing console, which is not scalable across many accounts and projects, and Cost Explorer filtering by tag does not centrally group costs across accounts without additional setup.

Practice this question →

308

MCQeasy

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

A.Amazon DynamoDB

B.Amazon Redshift

C.Amazon S3

D.Amazon RDS

AnswerC

S3 is the foundational storage service for data lakes.

Why this answer

Amazon S3 is the correct choice because it provides a highly durable, scalable, and cost-effective object storage service that can store data in its raw, native format (e.g., CSV, JSON, Parquet, images). It supports multiple query engines like Amazon Athena, Amazon Redshift Spectrum, and AWS Glue, allowing diverse teams to query the same data using different tools without data movement.

Exam trap

The trap here is that candidates often confuse a data lake's raw storage layer with a data warehouse (Redshift) or a transactional database (RDS, DynamoDB), failing to recognize that a data lake requires schema-on-read, object storage, and multi-engine query support, which only S3 provides.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database designed for low-latency, transactional workloads, not for storing raw, schema-less data lake files or supporting SQL-based analytics at scale. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse that requires data to be loaded and transformed into a structured, columnar format; it is not designed to store raw, unprocessed data from multiple sources. Option D is wrong because Amazon RDS is a relational database service that enforces a fixed schema and is optimized for OLTP workloads, making it unsuitable for storing diverse raw data formats and supporting ad-hoc queries from multiple analytics tools.

Practice this question →

309

MCQhard

A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?

A.Use S3 replication with SSE-KMS to copy logs from source accounts to the logging account.

B.Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.

C.Create a cross-account destination in each source account and attach a resource policy that grants the logging account permission to write.

D.Use the default AWS-managed KMS key for CloudWatch Logs in each source account.

AnswerB

This enables cross-account log delivery with customer-managed KMS encryption.

Why this answer

It uses a cross-account destination in the logging account with subscription filters in the source accounts, which is the standard pattern for streaming CloudWatch Logs across accounts. The KMS key policy must grant the CloudWatch Logs service in the source accounts permission to use the key (via kms:Encrypt and kms:Decrypt) so that logs can be encrypted at rest in the logging account while only the logging account manages the key.

Exam trap

The trap here is that candidates confuse cross-account destinations (which require the destination to be in the logging account) with cross-account resource policies (which are placed in the source account), leading them to choose Option C.

How to eliminate wrong answers

Option A is wrong because S3 replication with SSE-KMS copies logs from S3, not directly from CloudWatch Logs, and introduces an unnecessary intermediate service; the requirement is for CloudWatch Logs encryption at rest, not S3 replication. Option C is wrong because a cross-account destination must be created in the logging account (the destination account), not in each source account, and the resource policy should allow the source accounts to write to the destination, not the other way around. Option D is wrong because using the default AWS-managed KMS key means the key is managed by AWS and not by the logging account, violating the requirement that only the logging account can manage the key.

Practice this question →

310

MCQmedium

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

A.Use the management account to designate the member account as a delegated administrator for IAM Identity Center.

B.Enable AWS Organizations and create an admin role in the member account.

C.Create a new OU for the delegated administrator account.

D.Attach an SCP to allow IAM Identity Center actions in the member account.

AnswerA

This is the standard AWS procedure.

Why this answer

To delegate administration of IAM Identity Center to a member account, you must use the AWS Organizations management account to register that member account as a delegated administrator for IAM Identity Center. This is done via the AWS Organizations console or API (RegisterDelegatedAdministrator), which grants the member account the necessary permissions to manage IAM Identity Center settings, users, and groups without requiring full management account access. Only the management account can designate delegated administrators, and this action is specific to IAM Identity Center within AWS Organizations.

Exam trap

The trap here is that candidates often confuse generic cross-account role delegation (like creating an IAM role in a member account) with the specific AWS Organizations delegated administrator feature, which requires explicit registration from the management account and is not achieved by simply creating roles or policies.

How to eliminate wrong answers

Option B is wrong because enabling AWS Organizations and creating an admin role in the member account is a generic step for cross-account access, but it does not specifically delegate IAM Identity Center administration; delegated administration requires explicit registration via the management account, not just role creation. Option C is wrong because creating a new OU for the delegated administrator account is not required; delegated administrators can be any member account in any OU, and OUs are for organizational structure and policy application, not for enabling delegation. Option D is wrong because attaching an SCP to allow IAM Identity Center actions in the member account is unnecessary and incorrect; SCPs are used to restrict permissions, not to grant them, and delegation is controlled by the management account's registration, not by SCPs.

Practice this question →

311

MCQeasy

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

A.Use AWS Config to aggregate configuration data

B.Use Systems Manager Automation runbooks in each account

C.Use Systems Manager Explorer with multi-account management

D.Use CloudFormation StackSets to deploy Systems Manager agents

AnswerC

Explorer provides a single pane of glass for all accounts in the organization.

Why this answer

Systems Manager Explorer provides a built-in, multi-account view that aggregates operational data (e.g., patch compliance, inventory) from all member accounts in AWS Organizations without requiring custom scripts or manual setup. It leverages AWS Organizations to automatically discover and manage instances across accounts, making it the simplest centralized management solution.

Exam trap

The trap here is that candidates often confuse the provisioning of resources (StackSets) with the centralized management and visibility of existing resources (Explorer), leading them to choose Option D because they think deploying the SSM Agent is the key requirement, when in fact the agent is already present and the real need is cross-account operational visibility.

How to eliminate wrong answers

Option A is wrong because AWS Config aggregates configuration data and compliance history, but it does not provide Systems Manager's operational management capabilities (e.g., Run Command, Session Manager, Patch Manager) for EC2 instances. Option B is wrong because Systems Manager Automation runbooks are used for automated remediation or maintenance tasks within a single account; they do not natively provide centralized multi-account management or instance discovery across Organizations. Option D is wrong because CloudFormation StackSets can deploy the SSM Agent and other resources across accounts, but the agent is already installed by default on most modern AMIs, and StackSets do not enable the centralized management console (Explorer) or cross-account operational features; they only handle resource provisioning, not ongoing management.

Practice this question →

312

MCQhard

A company has a global AWS environment with multiple VPCs in different regions. The company uses AWS Transit Gateway to connect VPCs in the same region, but they need to interconnect VPCs across regions. The network team wants a solution that provides transitive routing across regions with minimal latency and operational overhead. Which solution should be implemented?

A.Set up a VPN connection between Transit Gateways in different regions.

B.Use AWS Direct Connect to connect the Transit Gateways in different regions.

C.Create VPC peering connections between all VPCs in different regions.

D.Use Transit Gateway peering attachments between Transit Gateways in different regions.

AnswerD

Transit Gateway peering provides transitive routing across regions with low latency.

Why this answer

Transit Gateway peering attachments enable transitive routing between Transit Gateways in different AWS regions, providing low-latency connectivity over the AWS global network without requiring VPN or Direct Connect. This solution minimizes operational overhead because AWS manages the peering connection and route propagation automatically, allowing VPCs attached to different Transit Gateways to communicate across regions.

Exam trap

The trap here is that candidates may confuse Transit Gateway peering with VPN or Direct Connect, assuming that cross-region connectivity requires a VPN or dedicated line, but AWS provides a native, managed peering feature that is simpler and more performant for inter-region Transit Gateway connectivity.

How to eliminate wrong answers

Option A is wrong because setting up a VPN connection between Transit Gateways introduces additional latency, complexity, and operational overhead due to managing VPN tunnels and encryption endpoints, and it does not leverage the AWS global backbone for optimal performance. Option B is wrong because AWS Direct Connect is a dedicated on-premises connection and cannot be used to directly interconnect Transit Gateways across regions; it would require additional routing and does not provide transitive routing between regions. Option C is wrong because VPC peering does not support transitive routing—each peering connection is a one-to-one relationship, so to connect all VPCs across regions you would need a full mesh of peering connections, which is not scalable and incurs high operational overhead.

Practice this question →

313

Multi-Selectmedium

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Select 2 answers

A.Implement an S3 bucket policy that restricts access based on the aws:SourceVpce condition key.

B.Create an IAM policy in each account that denies access unless the request comes from the approved IP range.

C.Use AWS PrivateLink to access all AWS services from within the VPC.

D.Create a service control policy (SCP) that denies access to resources unless the request originates from the approved IP address range.

E.Use AWS Resource Access Manager to share resources with approved accounts only.

AnswersA, D

Restricts access to requests from specific VPC endpoints.

Why this answer

An S3 bucket policy with the `aws:SourceVpce` condition key restricts access to only requests originating from a specific VPC endpoint, ensuring data can only be accessed from approved network locations within the VPC. Option D is correct because a service control policy (SCP) that denies access unless the request originates from an approved IP address range enforces a data perimeter across all accounts in the AWS Organization, preventing access from unapproved networks.

Exam trap

The trap here is that candidates often confuse IAM policies with SCPs, thinking that IAM policies can enforce organization-wide network restrictions, but SCPs are the only way to apply a deny across all accounts in an AWS Organization, and IAM policies are account-specific and can be overridden by resource-based policies.

Practice this question →

314

MCQmedium

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

A.Create IAM policies in each account to enforce encryption

B.Attach a service control policy (SCP) to the root that denies S3 actions unless encryption conditions are met

C.Use AWS Config rules with auto-remediation in each account

D.Deploy a CloudFormation StackSet that creates S3 buckets with encryption

AnswerB

SCPs can centrally deny operations that do not meet encryption requirements across all accounts in the organization.

Why this answer

A service control policy (SCP) attached to the root of the AWS Organizations hierarchy can deny S3 PutObject or CreateBucket actions unless the request includes the specific KMS key ID (via the s3:x-amz-server-side-encryption-aws-kms-key-id condition key). This enforces encryption centrally across all accounts, as SCPs are inherited by all member accounts and cannot be overridden by IAM policies within those accounts.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option C) thinking they provide preventive enforcement, but Config rules are detective and reactive, not preventive, whereas SCPs proactively block non-compliant API calls before the resource is created.

How to eliminate wrong answers

Option A is wrong because IAM policies in each account can be modified or bypassed by account administrators, and they do not provide centralized enforcement across the organization. Option C is wrong because AWS Config rules with auto-remediation are reactive (detect and fix non-compliant resources after creation) and do not prevent the initial creation of unencrypted buckets, plus they require per-account setup. Option D is wrong because a CloudFormation StackSet only creates buckets with encryption at deployment time but does not prevent users from creating unencrypted buckets outside of the StackSet, nor does it enforce encryption on existing or future buckets.

Practice this question →

315

MCQeasy

A company has multiple AWS accounts and wants to centrally manage CloudWatch dashboards. Which solution should they use?

A.Use CloudWatch cross-account dashboards with a monitoring account.

B.Use AWS Config aggregator to view resources.

C.Use Amazon QuickSight with data sources from each account.

D.Use AWS CloudFormation StackSets to deploy dashboards in each account.

AnswerA

Native cross-account dashboard feature.

Why this answer

CloudWatch cross-account dashboards allow you to create a single dashboard in a central monitoring account that displays metrics from multiple source accounts. This is the native AWS solution for centralized observability, requiring no additional data movement or custom code. The monitoring account uses the CloudWatch cross-account functionality to query metrics across accounts via IAM roles and the CloudWatch API.

Exam trap

The trap here is that candidates confuse AWS Config aggregator (which aggregates configuration data) with CloudWatch cross-account dashboards (which aggregate metric data), or assume CloudFormation StackSets provide a central view when they only replicate resources per account.

How to eliminate wrong answers

Option B is wrong because AWS Config aggregator is designed to aggregate resource configuration and compliance data, not CloudWatch metrics or dashboards; it cannot display time-series metric graphs. Option C is wrong because Amazon QuickSight is a business intelligence service for interactive dashboards and analytics, not a native CloudWatch dashboard viewer; it would require custom data pipelines to extract CloudWatch metrics into SPICE or S3, adding unnecessary complexity. Option D is wrong because AWS CloudFormation StackSets can deploy dashboard definitions across accounts, but each dashboard remains isolated in its own account; there is no central view or cross-account query capability, defeating the purpose of centralized management.

Practice this question →

316

MCQmedium

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

A.Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

B.Create an SCP that denies creation of resources unless they comply with the baseline.

C.Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.

D.Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

AnswerC

Control Tower automates account provisioning with pre-defined guardrails and blueprints.

Why this answer

AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Exam trap

The trap here is that candidates often confuse SCPs with automation tools, thinking they can enforce resource creation or trigger deployments, when in reality SCPs only restrict permissions and cannot provision resources or invoke AWS services.

How to eliminate wrong answers

Option A is wrong because SCPs cannot trigger AWS CloudFormation StackSets; SCPs are permission policies that control which AWS API actions are allowed, not event-driven automation triggers. Option B is wrong because an SCP that denies creation of resources unless they comply with a baseline would be impractical to enforce at the point of account creation and does not proactively create the required VPC and Config rules. Option D is wrong because AWS Config conformance packs are deployed to existing accounts to evaluate compliance, not to provision resources like a VPC, and SCPs cannot deploy conformance packs.

Practice this question →

317

Multi-Selectmedium

A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)

Select 2 answers

A.Share the approved AMIs from the central account with all other accounts.

B.Use AWS CloudFormation Guard to validate templates before deployment.

C.Apply an SCP that denies ec2:RunInstances with a condition that the image owner is not the central account.

D.Use AWS Service Catalog to create a product for approved AMIs.

AnswersA, C

Necessary so that accounts can launch from those AMIs.

Why this answer

Sharing AMIs from a central account with all other accounts allows those accounts to launch EC2 instances using the approved AMIs. Option C is correct because applying a service control policy (SCP) that denies ec2:RunInstances with a condition that the image owner is not the central account enforces that only AMIs owned by the central account can be used, preventing the use of unapproved AMIs from other sources.

Exam trap

The trap here is that candidates often think AWS Service Catalog or CloudFormation Guard can enforce organization-wide AMI restrictions, but they lack the ability to block direct API calls across all accounts without an SCP.

Practice this question →

318

MCQeasy

A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?

A.S3 buckets in each account with cross-region replication enabled to a central bucket.

B.Lambda functions in each account that read CloudWatch Logs and write to a central S3 bucket.

C.Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.

D.Amazon Kinesis Data Firehose delivery streams in each account sending logs to a centralized S3 bucket.

AnswerC

This provides near real-time streaming and cross-account aggregation.

Why this answer

It uses CloudWatch Logs subscription filters to stream log data in near real-time to a Kinesis Data Stream in the central logging account, which then feeds into Kinesis Data Firehose for durable delivery to S3. This architecture is resilient to Regional failures because Kinesis Data Streams can be configured with cross-region replication or multi-region failover, and Firehose can buffer and retry writes to S3 across availability zones. It provides near real-time delivery (typically within 60 seconds) and centralizes logs without relying on per-account S3 replication or Lambda polling.

Exam trap

The trap here is that candidates often choose Option A (S3 cross-region replication) because it seems simple and resilient, but they overlook the requirement for near real-time delivery, which S3 replication cannot guarantee due to its eventual consistency model and potential for multi-minute delays.

How to eliminate wrong answers

Option A is wrong because S3 cross-region replication is asynchronous and can introduce significant delays (often minutes to hours), not near real-time delivery, and it requires managing per-account S3 buckets with replication rules that can fail silently. Option B is wrong because Lambda functions reading CloudWatch Logs would require polling or event-driven triggers that introduce latency and scalability bottlenecks, and Lambda has a maximum execution timeout of 15 minutes, making it unsuitable for sustained high-volume log streaming. Option D is wrong because Kinesis Data Firehose delivery streams in each account cannot directly send logs to a centralized S3 bucket in another account without a cross-account role or destination configuration, and Firehose alone lacks the streaming aggregation and cross-account subscription capabilities that CloudWatch Logs subscription filters provide.

Practice this question →

319

MCQhard

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

A.Use AWS CloudTrail to monitor and alert when restricted instance types are launched.

B.Attach an SCP that denies the restricted instance types to the OU.

C.Create an IAM policy in the management account that denies the restricted instance types, and attach it to all member account users.

D.Attach an SCP to the root of the organization and exclude the management account.

AnswerB

SCPs attached to the OU apply to all member accounts but not to the management account.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that denies specific EC2 instance types to the OU, you restrict all member accounts while the management account is not affected by SCPs. This meets the requirement without impacting the management account.

Exam trap

The trap here is that candidates often think SCPs apply to all accounts including the management account, but in reality, the management account is never affected by SCPs, so attaching an SCP to the OU correctly restricts only member accounts.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail only provides auditing and alerting, not preventive enforcement; it cannot block the launch of restricted instance types. Option C is wrong because IAM policies attached in the management account do not propagate to member accounts; each member account has its own IAM namespace and would require separate policy attachments. Option D is wrong because SCPs attached to the root of the organization apply to all accounts, including the management account, unless explicitly excluded; however, SCPs cannot be applied to the management account at all, so excluding it is unnecessary and the statement is technically incorrect.

Practice this question →

320

MCQmedium

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

A.The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.

B.The IAM role does not exist in the same region as the user.

C.An SCP in the member account denies the sts:AssumeRole action.

D.The policy does not specify the exact member account ARN.

AnswerA

The role must trust the management account to allow AssumeRole.

Why this answer

The OrganizationAccountAccessRole in the member account must have a trust policy that explicitly allows the management account's IAM user (or the management account itself) to assume the role. Without this trust relationship, the sts:AssumeRole call from the management account user will be denied, even if the user's IAM policy grants permission to assume the role.

Exam trap

The trap here is that candidates often assume SCPs are the cause of cross-account access denials, but SCPs do not apply to principals in the management account; the real issue is almost always the trust policy on the target role.

How to eliminate wrong answers

Option B is wrong because IAM roles are global resources — they exist across all AWS regions, and region is not a factor in IAM role assumption. Option C is wrong because SCPs in the member account cannot deny actions to a user in the management account; SCPs only apply to principals within the member account's own organization hierarchy. Option D is wrong because the IAM policy attached to the user can use a wildcard or specify the member account ID without requiring the exact role ARN; the policy just needs to allow sts:AssumeRole on the role's ARN, which can include the member account number.

Practice this question →

321

MCQeasy

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

A.Make the bucket public with read-only access.

B.Generate presigned URLs for each account to access the bucket.

C.Create IAM roles in each account with permissions to assume a role in the central account.

D.Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.

AnswerD

Condition key ensures only accounts in the organization can access.

Why this answer

Using the `aws:PrincipalOrgID` condition key in an S3 bucket policy allows you to grant access to all principals (users, roles) within your AWS Organization without needing to list individual account IDs. This approach is both secure (no public access) and scalable (automatically includes new accounts added to the organization).

Exam trap

The trap here is that candidates often choose Option C (cross-account IAM roles) because it is a familiar pattern, but they overlook the simpler and more scalable centralized policy approach using the Organization ID condition key, which AWS specifically tests for centralized resource sharing scenarios.

How to eliminate wrong answers

Option A is wrong because making the bucket public with read-only access violates the principle of least privilege and exposes the data to any internet user, not just the intended accounts. Option B is wrong because presigned URLs are temporary and require manual generation and distribution for each account, which is not scalable for multiple accounts and does not provide a persistent, policy-based access control mechanism. Option C is wrong because creating IAM roles in each account with permissions to assume a role in the central account introduces cross-account trust complexity and requires managing role ARNs for every account, whereas the Organization ID condition key provides a simpler, centralized policy.

Practice this question →

322

MCQmedium

A company has a centralized logging account and multiple member accounts. The security team wants to enable VPC Flow Logs for all VPCs across all accounts and centralize the logs in the logging account. The solution must be automated and ensure that new VPCs are automatically included. Which approach should be taken?

A.Use AWS CloudTrail to monitor VPC creation and invoke an AWS Lambda function to enable Flow Logs.

B.Use Amazon EventBridge to capture VPC creation events and trigger an AWS Lambda function to enable Flow Logs.

C.Use an AWS Config rule to detect VPCs without Flow Logs and trigger an AWS Systems Manager Automation runbook to enable them, publishing to a centralized Amazon S3 bucket.

D.Use AWS Trusted Advisor to check VPC Flow Logs configuration and send alerts to an Amazon SNS topic.

AnswerC

This automates detection and remediation.

Why this answer

AWS Config can continuously evaluate all VPCs against a custom rule that checks for the presence of VPC Flow Logs. When a non-compliant VPC is detected (including newly created ones), Config can trigger an AWS Systems Manager Automation runbook that enables Flow Logs and publishes them to a centralized Amazon S3 bucket in the logging account. This approach is fully automated, covers existing and new VPCs, and centralizes logs without requiring event-driven triggers that might miss resources created before the rule was deployed.

Exam trap

The trap here is that candidates often choose EventBridge (Option B) because it seems like the most direct way to react to VPC creation, but they overlook the requirement to also handle existing VPCs and the need for continuous compliance monitoring, which AWS Config provides out of the box.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is designed to record API activity, not to monitor resource state or trigger remediation; using CloudTrail to invoke Lambda for VPC creation would require additional custom event processing and does not handle existing VPCs or VPCs created outside of CloudTrail’s scope. Option B is wrong because Amazon EventBridge captures real-time events like CreateVpc, but it only reacts to future VPC creation events and does not remediate VPCs that already exist without Flow Logs, nor does it provide ongoing compliance checks. Option D is wrong because AWS Trusted Advisor only checks for best practices on a limited set of resources and does not support automated remediation; it can send alerts via SNS but cannot enable Flow Logs or centralize logs, and it does not cover all VPCs in all accounts automatically.

Practice this question →

323

MCQhard

Refer to the exhibit. A security engineer applied this bucket policy to an S3 bucket. A developer tries to upload an object using the AWS CLI without specifying any encryption. What is the outcome?

A.The upload succeeds because the policy only denies if encryption is not KMS.

B.The upload fails because the bucket policy is malformed and rejects all requests.

C.The upload fails because the policy denies PutObject when encryption is not KMS with the specific key.

D.The upload succeeds because the developer is using the AWS CLI with default encryption settings.

AnswerC

Both statements deny the upload if the encryption does not match the required key. Without encryption, the condition is true, so the upload is denied.

Why this answer

The bucket policy includes a Deny statement that explicitly denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms and the x-amz-server-side-encryption-aws-kms-key-id header matching the specific KMS key ARN. Since the developer does not specify any encryption, the condition fails, and the Deny statement applies, causing the upload to fail.

Exam trap

The trap here is that candidates often assume a Deny without a matching Allow automatically blocks all requests, but they overlook that the Deny only applies when the condition is met; however, in this case, the condition is met because the request lacks the required encryption headers, so the Deny is triggered.

How to eliminate wrong answers

Option A is wrong because the policy denies PutObject when encryption is not KMS, not just when encryption is not KMS; the condition also requires a specific key ID, so any upload without the correct encryption headers is denied. Option B is wrong because the bucket policy is syntactically valid (it has proper Sid, Effect, Principal, Action, Resource, and Condition blocks) and is not malformed. Option D is wrong because the AWS CLI does not automatically apply KMS encryption with a specific key ID by default; without explicit encryption parameters, the request lacks the required headers and is denied by the policy.

Practice this question →

324

MCQhard

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all VPC Flow Logs from all accounts are delivered to a central Amazon S3 bucket in the logging account. The logs must be encrypted at rest using AWS KMS. The company currently uses AWS Organizations. Which solution meets these requirements with the least operational overhead?

A.Create a bucket in the logging account with default S3-managed encryption and enable VPC Flow Logs in each account to publish to that bucket.

B.Create a bucket in the logging account with a KMS key. Grant the necessary permissions to the VPC Flow Logs service in each account to write to that bucket using the KMS key. Enable VPC Flow Logs in each account to publish to the central bucket.

C.Create a bucket in each account with KMS encryption and use S3 Cross-Region Replication to copy logs to the central bucket.

D.Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket with KMS encryption.

AnswerB

Direct delivery to central bucket with KMS encryption.

Why this answer

It uses a central S3 bucket in the logging account with a customer-managed KMS key, which satisfies the encryption-at-rest requirement. By granting the VPC Flow Logs service principal in each account the necessary permissions to write to the central bucket and use the KMS key, logs are delivered directly without additional infrastructure. This approach minimizes operational overhead by avoiding replication, streaming services, or per-account bucket management.

Exam trap

The trap here is that candidates may overlook the KMS encryption requirement and choose Option A with SSE-S3, or assume that cross-account delivery requires complex replication or streaming services, when in fact VPC Flow Logs support direct cross-account S3 delivery with proper bucket and KMS key policies.

How to eliminate wrong answers

Option A is wrong because S3-managed encryption (SSE-S3) does not use AWS KMS, failing the explicit requirement for KMS encryption. Option C is wrong because it requires creating a bucket in each account and using S3 Cross-Region Replication, which adds complexity, cost, and potential replication delays, increasing operational overhead. Option D is wrong because it introduces Amazon Kinesis Data Firehose in each account, which adds unnecessary infrastructure and cost compared to direct VPC Flow Logs delivery to S3.

Practice this question →

325

MCQhard

A company uses AWS Organizations with 50 accounts. The network team wants to centrally manage VPC flow logs for all accounts, storing them in a central S3 bucket in the security account. The flow logs must be encrypted with a KMS key managed by the security account. What is the MOST efficient way to configure this?

A.Manually create VPC flow logs in each account and point to the central S3 bucket

B.Use AWS CloudFormation StackSets to deploy a stack that creates VPC flow logs with the required configuration in all accounts

C.Use AWS Config rules to enforce flow log creation across accounts

D.Use AWS Systems Manager Automation to create flow logs in each account

AnswerB

StackSets can deploy the same template across multiple accounts and regions, ensuring consistent configuration.

Why this answer

AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization. By defining the VPC flow log resource with the central S3 bucket ARN and the KMS key from the security account (using a cross-account KMS key policy), StackSets can automatically create flow logs in all member accounts with the required encryption, making it the most efficient and centralized approach.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option C) thinking they can enforce resource creation, but Config is a detective control, not a provisioning tool, and cannot directly create flow logs without additional automation.

How to eliminate wrong answers

Option A is wrong because manually creating VPC flow logs in each account is not scalable, error-prone, and violates the principle of central management for 50 accounts. Option C is wrong because AWS Config rules can only detect non-compliance (e.g., missing flow logs) and trigger remediation actions, but they cannot directly create or manage the flow log resources themselves; they rely on other services like AWS Systems Manager or Lambda for remediation, adding complexity. Option D is wrong because AWS Systems Manager Automation is designed for operational tasks on EC2 instances or on-premises machines, not for creating VPC flow logs across accounts; it lacks the native multi-account deployment capability that StackSets provides.

Practice this question →

326

MCQhard

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

A.Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

B.Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

C.Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

D.Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.

AnswerD

This enforces that account-level block public access settings cannot be changed, effectively blocking all public access.

Why this answer

S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Exam trap

The trap here is that candidates often confuse reactive detection (AWS Config) or partial policy restrictions (denying s3:PutBucketPolicy) with the comprehensive, preventive account-level block that SCPs can enforce, missing that S3 Block Public Access at the account level is the only way to block all public access without touching existing bucket policies.

How to eliminate wrong answers

Option A is wrong because CloudTrail only provides logging and alerting; it does not enforce or prevent public access, so it fails to meet the requirement to block public access without modifying bucket policies. Option B is wrong because denying s3:PutBucketPolicy does not block public access via bucket ACLs or object-level permissions; it only prevents policy changes, leaving other public access vectors open. Option C is wrong because AWS Config rules with auto-remediation via Lambda can detect and fix public buckets, but this is a reactive approach that may have a delay and does not proactively block public access at the account level as required.

Practice this question →

327

MCQeasy

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

A.Create a resource-based policy on each resource type that denies creation in unapproved Regions.

B.Create a service control policy (SCP) that denies actions in unapproved Regions. Attach it to the root or OUs.

C.Create an IAM policy that denies actions in unapproved Regions. Attach it to all IAM users and roles.

D.Enable AWS CloudTrail to log resource creation and set up a CloudWatch alarm to notify if resources are created in unapproved Regions.

AnswerB

SCPs provide centralized control over maximum permissions for accounts in an organization.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict AWS service actions across all accounts in an AWS Organization. By attaching an SCP that denies actions in unapproved Regions to the root or OUs, the security team ensures that no principal (including the root user) can create resources outside the allowed Regions, regardless of any IAM policies attached at the account level.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that attaching an IAM policy to all users is sufficient, but they overlook that SCPs are the only way to enforce restrictions across all accounts in an organization, including the management account's root user and any accounts that might have full administrative access.

How to eliminate wrong answers

Option A is wrong because resource-based policies are attached to individual resources (e.g., S3 bucket policies) and cannot be applied globally to prevent resource creation across all services; they also do not apply before the resource exists. Option C is wrong because IAM policies are attached to IAM users, groups, or roles and can be overridden by a user with administrative privileges or bypassed by the root user; they do not provide centralized enforcement across all accounts in an organization. Option D is wrong because CloudTrail and CloudWatch alarms are detective controls that only notify after a resource has been created in an unapproved Region, not preventive controls that block the action.

Practice this question →

328

Multi-Selecteasy

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

Select 2 answers

A.Configure an IAM identity provider to use the on-premises Active Directory.

B.Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.

C.Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.

D.Use AWS Resource Access Manager to share the AWS Managed Microsoft AD directory with other accounts in the organization.

E.Deploy AWS Managed Microsoft AD in each account and configure replication.

AnswersB, D

This enables users to authenticate with their existing credentials.

Why this answer

Establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.

Exam trap

The trap here is that candidates often confuse IAM identity providers (Option A) with Active Directory trust relationships, or they incorrectly assume that storing credentials in Parameter Store (Option C) is a valid authentication strategy for directory integration, when in fact the correct approach is to establish a forest trust and share the directory via RAM.

Practice this question →

329

Multi-Selectmedium

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Select 2 answers

A.Service control policies (SCPs) apply to all accounts in the organization, including the management account.

B.AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.

C.Each account in an organization must have its own payment method.

D.Consolidated billing allows you to combine usage and receive volume discounts.

E.AWS Config rules cannot be applied across accounts via AWS Organizations.

AnswersB, D

An organization trail automatically logs events for all accounts.

Why this answer

AWS Organizations allows you to create an organization trail in CloudTrail that logs events for all accounts within the organization from the management account. This simplifies audit and compliance by centralizing log collection without needing to configure trails individually in each member account.

Exam trap

The trap here is that candidates often assume SCPs apply to all accounts including the management account, but AWS explicitly excludes the management account from SCP effects to prevent accidental lockout of administrative access.

Practice this question →

330

Multi-Selecthard

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Select 3 answers

A.Enable CloudTrail to log all console logins and alert if MFA is not used.

B.Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.

C.Use AWS Config rules to detect IAM users without MFA and automatically remediate by sending notifications.

D.Use a service control policy (SCP) to require MFA on all IAM users.

E.Create an IAM policy that requires MFA for ConsoleLogin and attach it to all IAM users in each account.

AnswersB, C, E

IAM Identity Center can enforce MFA centrally for all accounts.

Why this answer

AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can enforce MFA enrollment, when in fact SCPs only deny actions based on the presence of MFA and cannot force users to configure or use MFA at login.

Practice this question →

331

MCQhard

A large financial services company uses AWS Organizations with over 200 accounts. The security team has implemented a Service Control Policy (SCP) that denies access to all services except a whitelist that includes Amazon S3, Amazon DynamoDB, AWS Lambda, and Amazon CloudWatch. Recently, the DevOps team reported that they cannot create new EC2 instances in their development account, even though the administrator explicitly attached an IAM policy allowing ec2:RunInstances. The SCP does not explicitly deny EC2. What is the most likely cause of this issue?

A.The IAM role used by the DevOps team has a trust policy that does not allow EC2 actions

B.The EC2 service has been disabled via AWS Config in that account

C.The development account is in an organizational unit (OU) with a different SCP that denies EC2

D.The SCP denies all services not explicitly allowed, and EC2 is not on the whitelist

AnswerD

SCPs that use an allow list deny all services not explicitly listed.

Why this answer

The SCP uses a deny-all approach with a whitelist of allowed services. Since EC2 is not on that whitelist, the SCP implicitly denies all EC2 actions, overriding any IAM policy that explicitly allows ec2:RunInstances. SCPs act as a guardrail that cannot be bypassed by account-level IAM policies.

Exam trap

The trap here is that candidates may think an explicit IAM allow can override an SCP, but SCPs set the maximum permissions boundary, so any action not explicitly allowed by the SCP is implicitly denied.

How to eliminate wrong answers

Option A is wrong because a trust policy controls which principals can assume a role, not the actions the role can perform; the issue is about authorization, not trust. Option B is wrong because AWS Config is a compliance and monitoring service, not a service control mechanism that can disable EC2; it cannot prevent API calls. Option C is wrong because the question states the SCP does not explicitly deny EC2, and the SCP described is the only one mentioned; while an OU-level SCP could cause this, the most direct and likely cause given the whitelist design is that EC2 is simply not allowed.

Practice this question →

332

MCQmedium

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

A.To ensure that only requests originating from accounts within the specified organization are allowed.

B.To restrict access to only the root user of the management account.

C.To enforce that all requests are made using HTTPS.

D.To allow access only from specific IP addresses within the organization.

AnswerA

The aws:SourceOrgID condition checks the organization ID.

Why this answer

The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Exam trap

The trap here is that candidates may confuse `aws:PrincipalOrgID` with other condition keys like `aws:SourceIp` or `aws:SecureTransport`, or assume it restricts to the management account root user, when in fact it validates organization membership for any principal in the organization.

How to eliminate wrong answers

Option B is wrong because the condition does not reference the root user of the management account; it uses `aws:PrincipalOrgID` which applies to all principals in the organization, not just the root user. Option C is wrong because enforcing HTTPS is done using the `aws:SecureTransport` condition key, not `aws:PrincipalOrgID`. Option D is wrong because restricting access to specific IP addresses is achieved with the `aws:SourceIp` condition key, not `aws:PrincipalOrgID`.

Practice this question →

333

MCQmedium

A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?

A.Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.

B.Use AWS CloudFormation StackSets to deploy CloudTrail and AWS Config in each account.

C.Use IAM permissions boundaries to restrict what users can do in each account.

D.Use AWS Config conformance packs to deploy rules across accounts.

AnswerA

Service Control Policies (SCPs) allow you to centrally control which AWS services and actions are allowed or denied across all accounts in an organization. By creating SCPs that deny actions that disable CloudTrail or AWS Config, you can enforce that these services remain enabled in all accounts, including new accounts that are created.

Why this answer

Service Control Policies (SCPs) can be used to enforce that CloudTrail and AWS Config are enabled and cannot be disabled by member accounts. Option B is wrong because CloudFormation StackSets require manual deployment to each account and do not prevent disabling. Option C is wrong because IAM permissions boundaries do not enforce service enablement.

Option D is wrong because AWS Config conformance packs deploy rules but cannot enforce CloudTrail enablement.

Practice this question →

334

MCQeasy

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

A.Create an IAM role with a policy that allows only t3.micro, and attach it to users in the dev OU.

B.Use AWS CloudFormation templates that specify t3.micro.

C.Apply a Service Control Policy (SCP) to the dev OU that denies ec2:RunInstances with instance type not equal to t3.micro.

D.Use AWS Config rules to terminate non-compliant instances.

AnswerC

SCPs prevent non-compliant actions at the OU level.

Why this answer

A Service Control Policy (SCP) applied to the dev OU can centrally restrict which EC2 instance types can be launched by all accounts within that OU. The SCP uses a Deny effect with a condition key ec2:InstanceType not equal to t3.micro, which prevents any IAM principal in the OU from launching non-compliant instances, regardless of their IAM permissions. This is the most effective way to enforce a hard boundary at the organization level.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option D) thinking they can prevent launches, but Config is detective, not preventive; SCPs are the correct preventive control at the organization level.

How to eliminate wrong answers

Option A is wrong because an IAM role attached to users does not apply to all principals in the OU; users could still launch instances via other roles or services, and the role does not enforce the restriction across all accounts in the OU. Option B is wrong because CloudFormation templates are not an enforcement mechanism; developers could bypass the template and launch instances manually via the console or CLI. Option D is wrong because AWS Config rules only detect and report non-compliance after the instance is launched; they do not prevent the launch, and terminating instances after creation is reactive and can incur costs and operational overhead.

Practice this question →

335

MCQhard

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

A.Use AWS Config rules to detect non-compliant security groups and send alerts.

B.Create a Python script that uses AWS SDK to apply security group rules to each VPC and run it periodically.

C.Use AWS Firewall Manager to centrally define and apply security group policies across accounts.

D.Use network ACLs instead of security groups to enforce segmentation.

AnswerC

Firewall Manager automates policy enforcement across all accounts.

Why this answer

AWS Firewall Manager is the correct choice because it provides a centralized, policy-based approach to define and apply security group rules across multiple accounts and VPCs in an AWS Organization. It integrates with AWS Transit Gateway to enforce consistent network segmentation in a hub-and-spoke model, minimizing operational overhead by automating rule enforcement and compliance without custom scripting or manual periodic checks.

Exam trap

The trap here is that candidates often confuse AWS Config's detective capabilities (alerting) with Firewall Manager's preventive and automated enforcement, or they underestimate the operational burden of custom scripting (Option B) versus a fully managed service like Firewall Manager.

How to eliminate wrong answers

Option A is wrong because AWS Config rules only detect and alert on non-compliant security groups; they do not automatically apply or enforce consistent rules across accounts, leaving remediation as a separate manual or automated step. Option B is wrong because creating a custom Python script with AWS SDK introduces significant operational overhead for maintenance, error handling, and periodic execution, and it lacks the native integration with AWS Organizations and centralized policy management that Firewall Manager provides. Option D is wrong because network ACLs are stateless and operate at the subnet level, not the instance level, making them unsuitable for granular, stateful security group-like policies; they also cannot be centrally managed across multiple accounts as easily as Firewall Manager's security group policies.

Practice this question →

336

MCQhard

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

A.Use cross-Region Read Replicas with automatic failover.

B.Use Amazon Aurora Global Database with MySQL compatibility.

C.Use a Multi-AZ RDS instance with a standby in another Region.

D.Use AWS Database Migration Service for continuous replication.

AnswerB

Amazon Aurora Global Database replicates data asynchronously across up to five AWS Regions with typical latency under one second, enabling a Recovery Point Objective (RPO) of seconds and a Recovery Time Objective (RTO) of under one minute by promoting a secondary region to primary. This satisfies the requirement for minimal data loss and sub-minute RTO across multiple Regions for disaster recovery.

Why this answer

Amazon Aurora Global Database with MySQL compatibility is designed for cross-Region disaster recovery with a Recovery Time Objective (RTO) of less than 1 minute and minimal data loss (typically sub-second). It uses storage-based replication that is asynchronous but with very low latency, and it supports a managed failover process that promotes a secondary Region to primary in under a minute, meeting the strict RTO requirement.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which is intra-Region) with cross-Region disaster recovery, or assume that cross-Region Read Replicas can achieve sub-minute RTO without understanding the manual promotion and DNS propagation delays inherent in that approach.

How to eliminate wrong answers

Option A is wrong because cross-Region Read Replicas for Amazon RDS for MySQL use asynchronous replication and require manual promotion to become the primary, which cannot guarantee an RTO of less than 1 minute due to the time needed for DNS changes and replication lag. Option C is wrong because Multi-AZ RDS instances only provide high availability within a single AWS Region by placing a standby in a different Availability Zone, not across Regions, so it cannot serve as a cross-Region disaster recovery solution. Option D is wrong because AWS Database Migration Service (DMS) is designed for one-time or ongoing migration tasks, not for automated failover with sub-minute RTO; it requires manual intervention to redirect traffic and does not provide the low-latency replication and automatic failover needed for disaster recovery.

Practice this question →

337

Multi-Selectmedium

A company uses AWS Organizations with 100 accounts. They want to restrict which AWS services can be used in the development OU. Which TWO steps should they take?

Select 2 answers

A.Use AWS CloudFormation StackSets to enforce service usage.

B.Use an SCP with an Allow effect for allowed services.

C.Use AWS Config rules to detect disallowed services.

D.Use IAM policies in each account to deny services.

E.Use an SCP with a Deny effect for services not allowed.

AnswersB, E

Explicitly allows only specified services.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict which AWS services can be used across accounts in an AWS Organization. An SCP with an Allow effect explicitly permits only the specified services, while an SCP with a Deny effect blocks the specified services; both approaches achieve the goal of restricting service usage at the OU level. SCPs apply to all IAM users, roles, and root users in the member accounts, making them the appropriate tool for this requirement.

Exam trap

The trap here is that candidates often choose AWS Config rules (option C) thinking detective controls can prevent actions, but Config is reactive and cannot block service usage; only SCPs or IAM permissions boundaries can proactively restrict services.

Practice this question →

338

Multi-Selecthard

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Select 3 answers

A.Route 53 Resolver outbound endpoints in each VPC to forward queries to the central resolver.

B.A Transit Gateway connecting all VPCs.

C.Route 53 private hosted zones associated with the shared services VPC.

D.Route 53 Resolver inbound endpoints in the shared services VPC.

E.VPC peering connections between each VPC and the shared services VPC.

AnswersA, B, C

Allows conditional forwarding.

Why this answer

Route 53 Resolver outbound endpoints in each VPC forward DNS queries from those VPCs to the central resolver in the shared services VPC, enabling conditional forwarding for private hosted zones. This is the standard mechanism for cross-account DNS resolution when using a central resolver, as it allows each VPC to send queries to a resolver that can access private hosted zones associated with the shared services VPC.

Exam trap

The trap here is that candidates often confuse inbound and outbound Resolver endpoints, assuming inbound endpoints are needed for forwarding queries from other VPCs, when in fact outbound endpoints are used to send queries out of a VPC to a central resolver.

Practice this question →

339

MCQmedium

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

A.The instance launches only if the developer's IAM policy explicitly allows t2.medium.

B.The instance launch is allowed because there is no explicit Allow statement in the SCP.

C.The instance launches successfully because the SCP does not affect IAM users.

D.The instance launch is denied because the SCP denies all instance types except t2.micro and t2.small.

AnswerD

Correct interpretation of the Deny with condition.

Why this answer

The SCP explicitly denies all EC2 instance types except t2.micro and t2.small. Since t2.medium is not in the allowed list, the deny effect applies, and the instance launch is blocked. SCPs act as a guardrail that overrides any Allow in IAM policies within the affected accounts.

Exam trap

The trap here is that candidates mistakenly think SCPs only apply to the root user or that an explicit Allow in an IAM policy can override an SCP Deny, but in reality SCPs set a maximum permission boundary that cannot be exceeded by any IAM policy within the account.

How to eliminate wrong answers

Option A is wrong because even if the developer's IAM policy explicitly allows t2.medium, the SCP deny overrides it; SCPs are evaluated before IAM policies and a deny in an SCP cannot be overridden by an IAM Allow. Option B is wrong because the SCP does contain an explicit Deny statement for all instance types except t2.micro and t2.small, so the absence of an explicit Allow is irrelevant; the Deny applies directly. Option C is wrong because SCPs apply to all principals in the account, including IAM users, not just the root user; they affect every identity under the OU.

Practice this question →

340

Multi-Selecthard

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Select 3 answers

A.Create IAM policies in each account that require encryption and versioning for any bucket creation.

B.Use AWS CloudFormation StackSets to deploy a stack in each account that creates a bucket with encryption and versioning, and use SCPs to prevent deletion.

C.Deploy AWS Config rules across all accounts to detect buckets without encryption or versioning and trigger auto-remediation.

D.Apply a service control policy (SCP) that denies s3:CreateBucket unless encryption and versioning are specified.

E.Use AWS CloudTrail to monitor bucket creation and send alerts.

AnswersB, C, D

Ensures a compliant bucket exists.

Why this answer

AWS CloudFormation StackSets allow you to deploy a standardized stack across multiple accounts in an organization, ensuring that any bucket created by the stack has encryption and versioning enabled. Combining this with a service control policy (SCP) that denies s3:CreateBucket unless encryption and versioning are specified (Option D) provides a preventive guardrail at the organization level. Additionally, deploying AWS Config rules with auto-remediation (Option C) acts as a detective and corrective measure, ensuring compliance even if buckets are created outside the approved stack.

Exam trap

The trap here is that candidates often think IAM policies alone can enforce resource configuration parameters, but IAM only controls permissions, not the actual values passed in the API call, which requires SCPs or service-specific controls.

Practice this question →

341

MCQeasy

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

A.Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.

B.Use IAM roles to grant developers access only to their own resources.

C.Use AWS Config rules to detect changes to networking resources.

D.Use resource tags to identify networking resources and apply IAM conditions.

AnswerA

SCPs can block specific actions across accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) allow the central IT team to define a permission guardrail that explicitly denies actions on networking resources (e.g., ec2:CreateVpc, ec2:DeleteSubnet) for developer accounts. SCPs are applied at the account or organizational unit level and cannot be overridden by any IAM policy within the account, ensuring developers cannot modify networking resources even if they have full administrative access.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or assume IAM roles alone can enforce cross-account restrictions without understanding that SCPs are the only mechanism to set a centralized permission boundary that cannot be bypassed by account administrators.

How to eliminate wrong answers

Option B is wrong because IAM roles grant permissions within an account but do not prevent developers from modifying networking resources if the role includes those permissions; they also cannot enforce restrictions across multiple accounts from a central point. Option C is wrong because AWS Config rules are detective, not preventive—they can detect changes to networking resources after they occur but cannot block the modification itself. Option D is wrong because resource tags combined with IAM conditions can restrict actions based on tags, but developers could still modify networking resources if they have permission to change tags or if the resources are not tagged; this approach is not a centralized, enforceable guardrail like SCPs.

Practice this question →

342

MCQeasy

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

A.It denies all actions if the request is not made over HTTPS.

B.It denies all actions if the request does not include multi-factor authentication.

C.It denies all actions from IP addresses outside the corporate network.

D.It allows all actions as long as the request is made over HTTPS.

AnswerA

The condition aws:SecureTransport false denies non-HTTPS requests.

Why this answer

This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is correct because it accurately describes this effect. Option B is incorrect because the SCP does not require MFA; it requires HTTPS.

Option C is incorrect because the SCP does not restrict IP addresses; it restricts unencrypted requests. Option D is incorrect because the SCP denies non-HTTPS requests, not allows all HTTPS requests.

Practice this question →

343

Multi-Selecthard

A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?

Select 2 answers

A.Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.

B.Use AWS Lambda to proxy database requests from member accounts.

C.Configure the RDS security group to allow inbound traffic from the member account VPC CIDRs.

D.Make the RDS instance publicly accessible and use IAM authentication.

E.Create a VPC peering connection between each member VPC and the shared services VPC.

AnswersA, C

Centralized connectivity for many VPCs.

Why this answer

AWS Transit Gateway acts as a central hub that allows you to connect multiple VPCs (including member account VPCs and the shared services VPC) in a scalable, managed way. By attaching all VPCs to the Transit Gateway and configuring route tables, you enable private, secure connectivity between member accounts and the central RDS instance without requiring individual VPC peering connections or exposing the database to the internet.

Exam trap

The trap here is that candidates often default to VPC peering (Option E) because it is a familiar concept, but they overlook that Transit Gateway (Option A) is the scalable, managed solution for connecting many VPCs in a multi-account environment, as tested in the SAP-C02 exam's organizational complexity domain.

Practice this question →

344

Multi-Selecthard

A company wants to use AWS Resource Access Manager (RAM) to share a subnet in a VPC with other accounts in the organization. Which of the following are required? (Choose THREE.)

Select 3 answers

A.The subnet must be created by the owning account.

B.The consumer accounts must accept the resource share invitation.

C.The VPC must be in the same AWS Region as the shared subnet.

D.Each consumer account must create a subnet in the same VPC.

E.Enable VPC sharing in the AWS Organizations console.

AnswersA, B, C

The owner creates the subnet to share.

Why this answer

AWS Resource Access Manager (RAM) requires the subnet to be created by the owning account. The owning account creates the subnet in its own VPC and then shares it via RAM. Consumer accounts cannot share subnets they did not create; they can only use the shared subnet to launch resources.

Exam trap

The trap here is that candidates often think VPC sharing requires enabling a feature in the Organizations console, but RAM handles the sharing directly without any Organizations-level toggle, and they also mistakenly believe consumer accounts must create subnets to use them.

Practice this question →

345

MCQmedium

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

A.Use AWS Config rules to automatically recreate any VPC that is deleted.

B.Use a resource-based policy on each centrally created VPC to deny ec2:DeleteVpc to the developers' roles.

C.Create an SCP for the developers' OU that denies ec2:DeleteVpc for all VPCs.

D.Create an IAM policy for developers that denies ec2:DeleteVpc unless the VPC has a specific tag.

AnswerD

Correct. An IAM policy with a condition key (e.g., based on a tag) can allow or deny the ec2:DeleteVpc action selectively. Developers can delete only VPCs that have a specific tag, while centrally created VPCs without that tag are protected from deletion.

Why this answer

VPCs do not support resource-based policies (making Option B invalid). An IAM policy with a condition based on a tag can effectively restrict deletion. For example, developers can be allowed to delete VPCs only if the VPC has a specific tag (e.g., 'AllowDeletion: true'), which they can add to their own VPCs.

Centrally created VPCs would lack this tag, so deletion is denied. This provides granular control without affecting other permissions.

Exam trap

The key trap is that candidates often think resource-based policies (Option B) can be applied to VPCs, but VPCs do not support them. Instead, tag-based conditions in IAM policies or SCPs are the correct mechanisms for selective denial.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive and can only detect and remediate non-compliant resources after the fact; they cannot prevent the deletion from occurring in the first place, and automatically recreating a VPC does not meet the requirement to restrict deletion. Option C is wrong because an SCP that denies ec2:DeleteVpc for all VPCs would also prevent developers from deleting their own VPCs, which is overly restrictive and does not allow developers to manage their own VPCs as required. Option D is wrong because an IAM policy that denies ec2:DeleteVpc unless the VPC has a specific tag can be circumvented if developers add that tag to centrally created VPCs before deleting them, and it does not provide a reliable mechanism to distinguish centrally created VPCs from developer-created VPCs.

Practice this question →

346

MCQhard

A company uses AWS Organizations with a multi-account setup. The central IT team manages a shared services VPC in the network account, which hosts a NAT gateway, a VPN connection to the on-premises network, and a transit gateway. Several application accounts have VPCs attached to the transit gateway. Recently, the application teams report that they cannot reach the on-premises network through the VPN. The network team confirms that the VPN is up and routes are propagated in the transit gateway route tables. However, the application VPCs are not receiving the routes. What is the MOST likely cause?

A.The application VPCs have route tables that override the transit gateway routes with local routes.

B.The VPN connection is not configured to advertise the on-premises CIDR to the transit gateway.

C.The application VPCs have security groups that block traffic to the on-premises network.

D.The transit gateway route tables are not associated with the application VPC attachments.

AnswerD

For routes to be effective, the transit gateway route table that contains the VPN routes must be associated with the VPC attachments; otherwise, they won't receive the routes.

Why this answer

The most likely cause is that the transit gateway route tables are not associated with the application VPC attachments. Even if the VPN routes are propagated into the transit gateway route tables, the application VPCs will not receive those routes unless their VPC attachments are explicitly associated with the correct transit gateway route table. Without this association, the transit gateway does not propagate routes to the attached VPCs, leaving them unable to reach the on-premises network.

Exam trap

The trap here is confusing route propagation with route table association — candidates often assume that if routes are propagated into the transit gateway route table, all attached VPCs automatically receive them, but AWS requires an explicit association between the VPC attachment and the route table for route distribution.

How to eliminate wrong answers

Option A is wrong because local routes in VPC route tables have a higher priority than transit gateway routes by default, but the question states the application VPCs are not receiving the routes at all, not that they are being overridden. Option B is wrong because the network team confirmed that routes are propagated in the transit gateway route tables, meaning the VPN is correctly advertising the on-premises CIDR to the transit gateway. Option C is wrong because security groups operate at the instance level, not at the VPC routing level, and the issue is about route propagation, not traffic filtering.

Practice this question →

347

MCQeasy

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

A.AWS Control Tower

B.Delegated administrator for AWS services

C.Cross-account IAM roles

D.AWS CloudTrail organization trail

AnswerB

This allows a member account to administer services like GuardDuty, Macie, etc., across the organization.

Why this answer

Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Exam trap

The trap here is that candidates often confuse the broad, role-based access of cross-account IAM roles (Option C) with the specific, service-level delegation model of delegated administrators, leading them to overlook the AWS Organizations-native feature designed for this exact purpose.

How to eliminate wrong answers

Option A is wrong because AWS Control Tower is a service for setting up and governing a multi-account environment using pre-built blueprints and guardrails, not for delegating administrative tasks for specific AWS services to a member account. Option C is wrong because cross-account IAM roles provide broad, role-based access to resources in another account but are not designed for the specific, service-level delegation model that AWS Organizations supports for delegated administrators. Option D is wrong because AWS CloudTrail organization trail logs API activity across all accounts in the organization for auditing, not for delegating administrative tasks for specific services.

Practice this question →

348

MCQmedium

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?

A.Define cost allocation tags in the management account and activate them for all accounts.

B.Use AWS Config rules to automatically tag resources after creation.

C.Use an SCP that denies resource creation if the required tags are not present.

D.Use tag policies in AWS Organizations to enforce required tags on resources.

AnswerD

Tag policies can enforce tagging across all accounts.

Why this answer

Tag policies in AWS Organizations allow you to centrally define and enforce required tags across all accounts in the organization. When a tag policy is attached to an OU or account, it ensures that resources are created with the specified tags, and noncompliant resources can be identified. This is the most scalable and consistent approach for tagging resources that span multiple accounts, as it works at the organization level without requiring per-account configuration.

Exam trap

The trap here is that candidates often confuse tag policies with SCPs or AWS Config rules, thinking that SCPs alone can enforce tag requirements, but SCPs only block actions based on existing tags and cannot enforce tag key presence for all services, whereas tag policies provide a centralized, organization-wide mechanism for defining and enforcing tag schemas.

How to eliminate wrong answers

Option A is wrong because cost allocation tags defined in the management account are not automatically propagated to member accounts; each account must activate them individually, and they only apply to billing reports, not to resource creation enforcement. Option B is wrong because AWS Config rules can only detect and remediate noncompliant resources after creation (e.g., via auto-remediation), but they do not prevent the creation of untagged resources in the first place, leading to potential gaps. Option C is wrong because SCPs can deny resource creation based on the absence of tags only if the service supports condition keys for tags in the IAM policy evaluation; not all services support this, and SCPs cannot enforce tag keys or values—they can only block actions based on existing tags.

Practice this question →

349

MCQhard

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

A.The SCP is overridden by a service control policy that allows the action.

B.The SCP does not have an explicit deny; it uses a default deny.

C.SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters.

D.The SCP is not applied to the root organizational unit.

AnswerC

SCPs cannot check existing bucket configuration.

Why this answer

The most likely reason is option C: SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters. SCPs do not have visibility into the current configuration of resources like S3 bucket versioning. Therefore, an SCP that attempts to deny PutBucketVersioning if versioning is not enabled cannot work because it cannot check the bucket's current versioning status.

This allows users to disable versioning. Option A is incorrect because SCPs are hierarchical and cannot be overridden by another SCP unless there is an explicit allow, but the core issue is the condition evaluation. Option B is incorrect because SCPs use explicit deny, not a default deny.

Option D is incorrect because applying the SCP to the root OU would not resolve the fundamental limitation that SCPs cannot check resource state.

Practice this question →

350

Multi-Selectmedium

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

Select 2 answers

A.Centrally enforce policies using service control policies (SCPs).

B.Automatically create VPC peering connections between accounts.

C.Simplify cross-region replication for Amazon RDS databases.

D.Isolate workloads and provide a boundary for security and cost management.

E.Reduce the total cost of EC2 instances by aggregating usage across accounts.

AnswersA, D

SCPs apply to all accounts in the organization.

Why this answer

Service control policies (SCPs) allow you to centrally manage permissions for all accounts in your AWS Organizations hierarchy. SCPs act as a guardrail, enabling you to define the maximum available permissions for IAM roles and users across member accounts without granting any permissions themselves. This ensures consistent enforcement of security and compliance policies across the entire organization.

Exam trap

The trap here is that candidates often confuse consolidated billing with direct cost reduction for EC2 instances, not realizing that aggregation only enables volume discounts and does not lower the per-instance price automatically.

Practice this question →

351

MCQhard

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

A.Create an IAM policy in each account that requires the tag for ec2:RunInstances.

B.Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.

C.Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

D.Configure the EC2 service to automatically add the tag to all instances.

AnswerB

SCPs can conditionally deny actions based on tags.

Why this answer

A Service Control Policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the ec2:RunInstances action unless the request includes the required 'CostCenter' tag. This enforces the tagging requirement across all accounts in the organization without needing per-account IAM policies, and it cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config) with preventive controls (like SCPs), or assume that IAM policies in each account are sufficient for centralized enforcement, overlooking the fact that SCPs are the only mechanism that can enforce policies across all accounts in an organization without being overridden.

How to eliminate wrong answers

Option A is wrong because IAM policies in each account can be modified or removed by account administrators, so they do not provide centralized enforcement across a multi-account environment. Option C is wrong because AWS Config rules are detective, not preventive; they can detect untagged instances after launch but cannot block the creation of untagged instances, which violates the security team's requirement to enforce tagging at launch time. Option D is wrong because the EC2 service does not have a native feature to automatically add tags to all instances; tags must be explicitly provided in the RunInstances request or added via automation after launch.

Practice this question →

352

MCQhard

Refer to the exhibit. A company applies this S3 bucket policy to a central logging bucket. CloudTrail trails in multiple accounts are configured to deliver logs to this bucket. Recently, logs stopped being delivered. What is the most likely cause?

A.CloudTrail does not automatically set the 'bucket-owner-full-control' ACL when delivering logs.

B.The Principal element uses 'cloudtrail.amazonaws.com' which is not the correct service principal.

C.The Resource ARN does not include the account ID, so it matches all accounts.

D.The policy uses 'Deny' which is not allowed in S3 bucket policies.

AnswerA

The condition requires the ACL, but CloudTrail does not set it, causing denial.

Why this answer

When CloudTrail delivers logs to an S3 bucket owned by a different account, it does not automatically set the 'bucket-owner-full-control' ACL on the delivered objects. Without this ACL, the bucket owner (the central logging account) does not have full control over the objects, and the bucket policy's Deny statement (which requires s3:GetObjectAcl and s3:PutObjectAcl for bucket-owner-full-control) will block access, causing log delivery to fail. The solution is to configure CloudTrail to apply the 'bucket-owner-full-control' canned ACL or modify the bucket policy to grant the bucket owner full control via a different mechanism.

Exam trap

The trap here is that candidates often overlook the ACL requirement for cross-account S3 log delivery, assuming that a bucket policy alone is sufficient to grant the bucket owner full control, when in fact CloudTrail must be explicitly configured to set the 'bucket-owner-full-control' ACL.

How to eliminate wrong answers

Option B is wrong because 'cloudtrail.amazonaws.com' is the correct service principal for CloudTrail in S3 bucket policies; it is not a mistake. Option C is wrong because the Resource ARN does not need to include the account ID for the policy to work across accounts; the ARN format 'arn:aws:s3:::bucket-name/*' correctly matches objects in the bucket regardless of the delivering account. Option D is wrong because 'Deny' is absolutely allowed in S3 bucket policies and is commonly used to explicitly deny actions that would otherwise be allowed by other policies.

Practice this question →

353

Drag & Dropmedium

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order is: first create the virtual interface in AWS, then configure the on-premises router, establish BGP, verify availability, and finally update route tables.

Practice this question →

354

MCQhard

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles for cross-account access. They want to ensure that when a role is created in a member account, it automatically adheres to the principle of least privilege and is auditable. What solution should they implement?

A.Use AWS CloudFormation StackSets to deploy IAM roles from a central template in each account.

B.Use AWS Organizations service control policies (SCPs) to deny creation of IAM roles except through AWS CloudFormation, and use a centrally managed CloudFormation template via StackSets.

C.Configure AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them.

D.Create a Lambda function that monitors CloudTrail events for role creation and sends alerts.

AnswerB

SCPs can enforce that roles are only created via CloudFormation, and StackSets ensure consistent deployment and auditing.

Why this answer

AWS Organizations SCPs can be used to deny the creation of IAM roles except through AWS CloudFormation, ensuring that roles are only created via a centrally managed template. By combining this with AWS CloudFormation StackSets, the security team can deploy IAM roles from a single template across all member accounts, enforcing the principle of least privilege and providing full auditability through CloudFormation stack events and AWS CloudTrail.

Exam trap

The trap here is that candidates often choose Option A, thinking that CloudFormation StackSets alone provide enforcement, but they miss the critical need for a preventive control (SCPs) to block manual role creation outside the template.

How to eliminate wrong answers

Option A is wrong because using CloudFormation StackSets alone to deploy IAM roles does not prevent users from creating roles manually outside the template, so it fails to enforce the principle of least privilege or ensure auditability. Option C is wrong because configuring AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them is a reactive approach that does not prevent the creation of non-compliant roles in the first place, leading to potential security gaps and operational overhead. Option D is wrong because creating a Lambda function that monitors CloudTrail events for role creation and sends alerts is also reactive; it only notifies after a role is created, without enforcing least privilege or preventing non-compliant roles from being created.

Practice this question →

355

Multi-Selectmedium

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

Select 2 answers

A.Configure cross-account CloudWatch Logs subscription.

B.Create a centralized S3 bucket in the logging account.

C.Use VPC Flow Logs with Amazon Kinesis Data Firehose.

D.Apply an SCP that requires VPC Flow Logs to be enabled.

E.Use AWS Config rules to enable flow logs automatically.

AnswersB, D

VPC Flow Logs can be delivered to an S3 bucket.

Why this answer

Centralizing VPC flow logs requires a single S3 bucket in a dedicated logging account to aggregate logs from all accounts. This bucket must have a bucket policy that grants the necessary permissions for the flow log service to write logs from member accounts, enabling centralized storage and management.

Exam trap

The trap here is that candidates often think AWS Config rules can automatically enable flow logs, but Config only evaluates compliance and requires a separate remediation action (e.g., Lambda) to actually enable the resource, making it an indirect and incomplete solution compared to an SCP that enforces the setting.

Practice this question →

356

MCQhard

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

A.Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.

B.Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.

C.Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.

D.Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.

AnswerC

Transit gateway enables transitive routing for inspection.

Why this answer

A transit gateway allows you to centralize outbound internet traffic by attaching both the production VPC and the inspection VPC, then configuring the production VPC's route table to send 0.0.0.0/0 traffic to the transit gateway. The inspection VPC can then route that traffic through its firewall (e.g., a third-party appliance or AWS Network Firewall) before it reaches an internet gateway, enabling full traffic inspection while maintaining a single egress point.

Exam trap

The trap here is that candidates often assume VPC peering can be used for transitive routing or that a NAT gateway provides inspection capabilities, but VPC peering is non-transitive and NAT gateways only perform address translation, not deep packet inspection.

How to eliminate wrong answers

Option A is wrong because AWS Cloud WAN is designed for global network connectivity across multiple regions and on-premises locations, not for routing internet-bound traffic through a centralized inspection VPC within a single region; it lacks the granular route table controls needed to force internet traffic through a specific inspection VPC. Option B is wrong because VPC peering does not support transitive routing—traffic from the production VPC to the internet would need to go through the peered connection to the inspection VPC, but the inspection VPC cannot forward that traffic to its internet gateway because VPC peering does not allow a VPC to act as a transit hub for internet-bound traffic. Option D is wrong because placing a NAT gateway in the inspection VPC and routing production VPC traffic to it would require the production VPC to send internet-bound traffic directly to the NAT gateway's private IP, which is not routable across VPC boundaries without additional infrastructure; moreover, the NAT gateway itself does not provide traffic inspection capabilities.

Practice this question →

357

MCQeasy

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

A.Use AWS Transit Gateway to connect individual VPCs managed by each team.

B.Use a shared VPC with separate subnets for each team, with IAM policies to control access.

C.Create a single VPC and use VPC peering to connect team resources.

D.Create a separate VPC for each application team and use VPC peering.

AnswerB

Shared VPC allows central management of network resources while teams manage their own resources.

Why this answer

A shared VPC allows the central IT team to own and manage the networking resources (VPC, subnets, route tables, etc.) while each application team can independently manage their own EC2 instances and RDS databases within their designated subnets. IAM policies can be scoped to restrict each team to only their subnets and resources, achieving clear separation of duties without requiring multiple VPCs or complex connectivity.

Exam trap

The trap here is that candidates often assume separate VPCs or Transit Gateway are necessary for isolation, but the shared VPC model with IAM policies provides both centralized network management and delegated resource control, which is the exact pattern tested in the SAP-C02 exam for organizational complexity.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway connects multiple VPCs but does not provide a mechanism for the central IT team to centrally manage networking while delegating resource management to application teams; each team would still need to manage their own VPC, and Transit Gateway adds cost and complexity without solving the separation of duties requirement. Option C is wrong because creating a single VPC and using VPC peering to connect team resources is redundant (peering is unnecessary within a single VPC) and does not allow the central team to control networking while isolating teams; all teams would share the same VPC without subnet-level isolation unless subnets are used, but the option fails to mention subnet separation or IAM controls. Option D is wrong because creating a separate VPC for each team and using VPC peering forces each team to manage their own VPC (including subnets, route tables, and security groups), which contradicts the requirement that the central IT team manages networking resources; VPC peering also does not provide centralized network management and introduces transitive routing limitations.

Practice this question →

358

MCQmedium

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

A.Create a view that unions all the tables for each account, and update the view DDL when a new account is added.

B.Use AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type. Enable partition indexing to improve query performance.

C.Create an Athena table with partitions manually for each account and use MSCK REPAIR TABLE to add new partitions.

D.Convert all logs to Parquet format using AWS Glue ETL jobs and store them in a single prefix.

AnswerB

Glue crawlers automatically discover new partitions and update the table metadata.

Why this answer

Using AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type allows automatic discovery of new partitions as new accounts are added. The crawler can be scheduled to run periodically, updating the table metadata without manual intervention. Partition indexing improves query performance by reducing the amount of data scanned.

Option A is incorrect because updating a view requires manual DDL changes each time a new account is added. Option C is incorrect because manually managing partitions and using MSCK REPAIR TABLE still requires manual effort to add new partitions. Option D is incorrect because converting logs to Parquet adds overhead and does not solve the need for automatic partition discovery across accounts.

Practice this question →

359

MCQeasy

A company wants to automate the creation of new AWS accounts and apply baseline security configurations. Which combination of services should be used to achieve this?

A.AWS Service Catalog and AWS Config.

B.AWS Organizations API and CloudTrail.

C.AWS Control Tower and Service Control Policies (SCPs).

D.AWS CloudFormation StackSets and IAM.

AnswerC

Control Tower provides account factory and guardrails via SCPs.

Why this answer

AWS Control Tower provides a managed service to automate the creation of new AWS accounts through Account Factory, while Service Control Policies (SCPs) enforce baseline security guardrails across all accounts in the organization. This combination ensures that every new account is provisioned with consistent security policies without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Control Tower with AWS Organizations alone, forgetting that Control Tower adds automated account provisioning and pre-built security guardrails (SCPs) that Organizations alone does not provide.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog is used for creating and managing approved IT service catalogs, not for automating account creation, and AWS Config is a configuration auditing service, not a provisioning tool. Option B is wrong because the AWS Organizations API can create accounts programmatically but lacks built-in baseline security configuration enforcement; CloudTrail only logs API activity and does not apply security policies. Option D is wrong because AWS CloudFormation StackSets deploy infrastructure templates across accounts but do not automate account creation itself, and IAM manages user permissions but not account provisioning or baseline security guardrails.

Practice this question →

360

MCQhard

A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?

A.Enable CloudTrail with a trail that logs to a bucket in a separate account, and use IAM policies to deny CloudTrail deletion.

B.Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and rely on S3 versioning to recover deleted logs.

C.Create an IAM policy in each account that denies CloudTrail deletion and attach it to all IAM users and roles.

D.Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.

AnswerD

Combines SCP and bucket policy for comprehensive protection.

Why this answer

It combines an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket with a bucket policy that denies s3:DeleteObject for all principals except the management account. This layered approach ensures that even if an account has full administrative permissions, the SCP blocks the CloudTrail and S3 actions, while the bucket policy prevents any account (including the root user) from deleting log files, with the management account as the sole exception for recovery purposes.

Exam trap

The trap here is that candidates assume an SCP alone is sufficient to protect CloudTrail logs, forgetting that SCPs do not protect the S3 bucket where logs are stored, and that IAM policies in individual accounts are ineffective against root user actions or privilege escalation.

How to eliminate wrong answers

Option A is wrong because IAM policies alone cannot prevent actions performed by the root user or by services that bypass IAM, and they are not enforceable across all accounts without additional controls. Option B is wrong because relying solely on S3 versioning does not prevent deletion of log files; versioning only allows recovery after deletion, and the SCP does not protect the S3 bucket from direct delete actions on objects. Option C is wrong because IAM policies in each account are not enforceable against the root user or against users with full administrative privileges, and they require manual maintenance across all accounts, making them unreliable for organization-wide enforcement.

Practice this question →

361

MCQhard

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

A.The S3 bucket has a lifecycle policy that deletes logs after a short period.

B.The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

C.The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.

D.The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

AnswerC

The bucket policy likely restricts access to the logging account's role, so the analyst's direct access is denied.

Why this answer

The S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Exam trap

The trap here is that candidates often overlook bucket policy conditions that restrict principal types, assuming that granting read-only access to the S3 bucket via IAM is sufficient, when in fact the bucket policy itself may explicitly deny access to non-service principals.

How to eliminate wrong answers

Option A is wrong because a lifecycle policy that deletes logs after a short period would cause logs to be missing, but the analyst cannot access any logs at all, indicating a permissions issue rather than data absence. Option B is wrong because requiring the analyst to assume a role in the logging account is a valid cross-account access pattern; if the bucket policy allowed it, the analyst could assume the role and access the logs, so this is not the most likely cause. Option D is wrong because while KMS encryption could block access if the analyst lacks decrypt permissions, the question states the analyst has read-only access to the S3 bucket, and KMS key permissions are separate from S3 bucket policies; the most likely cause is a bucket policy restriction, not encryption.

Practice this question →

362

MCQhard

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

A.The SCPs applied to member accounts are blocking CloudTrail from sending logs.

B.CloudTrail is a regional service and the trail is only in one region.

C.Member accounts have IAM policies that deny CloudTrail logging.

D.The trail was not created as an organization trail.

AnswerD

An organization trail must be enabled to log events from all accounts.

Why this answer

When a CloudTrail trail is created in the management account without enabling the 'organization trail' option, it only logs events for the management account itself and not for member accounts. To centralize logging across all accounts in AWS Organizations, the trail must be explicitly created as an organization trail, which automatically applies to all current and future member accounts. Without this setting, member account events are not forwarded to the management account's trail.

Exam trap

The trap here is that candidates often assume that creating a trail in the management account automatically covers all member accounts, but they overlook the explicit requirement to designate the trail as an organization trail during creation.

How to eliminate wrong answers

Option A is wrong because SCPs (Service Control Policies) can only deny or allow actions at the AWS Organizations level, but they do not block CloudTrail from sending logs; CloudTrail delivers logs to an S3 bucket, and SCPs cannot prevent that delivery unless they explicitly deny the `cloudtrail:PutEventSelectors` or similar actions, which is not the described issue. Option B is wrong because the question states the trail logs events across all regions, and CloudTrail trails can be configured as multi-region trails, so a single trail can capture events from all regions. Option C is wrong because IAM policies in member accounts do not affect CloudTrail logging; CloudTrail operates at the AWS service level and does not require IAM permissions in member accounts to log management events, as the trail is managed from the management account.

Practice this question →

363

Multi-Selectmedium

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

Select 3 answers

A.Configure Amazon CloudWatch agent to send inventory data.

B.Set up an AWS Config aggregator in the management account.

C.Enable AWS Systems Manager Inventory in each account.

D.Create an IAM role in each member account that trusts the central account.

E.Enable AWS Systems Manager in each account.

AnswersC, D, E

Inventory collects instance information.

Why this answer

AWS Systems Manager Inventory provides a native, agentless mechanism to collect and query EC2 instance metadata, software inventory, and configuration across accounts. Enabling Systems Manager in each account is a prerequisite for using Inventory, as it relies on the SSM Agent and the Systems Manager service to gather and store inventory data in a centralized manner.

Exam trap

The trap here is that candidates often confuse AWS Config aggregators (which aggregate compliance data) with Systems Manager Inventory (which aggregates EC2 inventory data), leading them to incorrectly select Option B as a necessary step.

Practice this question →

364

MCQeasy

A startup is using a single AWS account for development, testing, and production. They want to isolate environments and improve security. What is the most aligned AWS best practice?

A.Use separate VPCs within the same account.

B.Use IAM policies to restrict access per environment.

C.Create separate AWS accounts for each environment using AWS Organizations.

D.Use resource tagging to separate environments.

AnswerC

Accounts provide strong isolation boundaries.

Why this answer

Creating separate AWS accounts via AWS Organizations (Option C) is the recommended best practice for isolating environments and enhancing security. This approach provides strong logical and billing separation, aligns with the AWS Well-Architected Framework's security pillar, and minimizes blast radius. Option A (separate VPCs) does not fully isolate because all resources still reside in the same account, sharing service quotas and increasing risk.

Option B (IAM policies) alone cannot prevent cross-environment access at the network or resource level. Option D (resource tagging) only aids in organization, not isolation.

Practice this question →

365

Multi-Selecthard

Which THREE design patterns are recommended for decoupling components in a microservices architecture on AWS?

Select 3 answers

A.Use Amazon EventBridge for event-driven integration.

B.Use AWS Direct Connect for private connectivity.

C.Use Amazon SNS topics for pub/sub messaging.

D.Use Amazon SQS queues between services.

E.Use Elastic Load Balancing to distribute traffic.

AnswersA, C, D

EventBridge decouples event producers and consumers.

Why this answer

Amazon EventBridge provides a fully managed event bus that decouples microservices by enabling event-driven communication. Services publish events to EventBridge, which then routes them to appropriate consumers based on rules, eliminating direct dependencies between producers and consumers.

Exam trap

The trap here is that candidates may confuse network connectivity solutions (Direct Connect) or load balancing (ELB) with true decoupling patterns, but decoupling in microservices requires asynchronous, event-driven or message-based integration, not synchronous request/response or network links.

Practice this question →

366

MCQeasy

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

A.Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.

B.Manually enable CloudTrail in each account by logging into every account.

C.Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.

D.Create an SCP that requires CloudTrail to be enabled in each account.

AnswerC

StackSets allow centralized, automated deployment of CloudTrail across accounts.

Why this answer

AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.

Exam trap

The trap here is that candidates often confuse the capabilities of SCPs (which only control permissions) with resource enforcement, leading them to incorrectly select Option D, not realizing that SCPs cannot create or enable resources like CloudTrail.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can only detect non-compliance and trigger auto-remediation via Systems Manager Automation or Lambda, but they do not natively deploy CloudTrail across all accounts; they react to existing resources rather than proactively provisioning them, making them less efficient for initial deployment. Option B is wrong because manually enabling CloudTrail in each account by logging into every account is not scalable, error-prone, and violates the principle of least effort for a multi-account environment. Option D is wrong because Service Control Policies (SCPs) can only deny or allow API actions, not enforce the presence of a resource like CloudTrail; an SCP cannot require CloudTrail to be enabled—it can only block actions that disable it, which is insufficient to ensure initial enablement.

Practice this question →

367

MCQmedium

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

A.The account has an unpaid AWS bill.

B.The account was suspended due to a Service Control Policy (SCP) violation.

C.The account was suspended due to a security breach detected by AWS.

D.The account was removed from the organization by the root user.

AnswerA

AWS suspends accounts with overdue payments.

Why this answer

When an AWS account is suspended, the most common reason is an unpaid bill. AWS suspends accounts that have outstanding charges beyond the payment due date, disabling access to resources until the balance is paid. The command output showing the 'Prod' account as 'SUSPENDED' directly indicates a billing issue, as AWS does not suspend accounts for SCP violations, security breaches, or removal from an organization in the same manner.

Exam trap

The trap here is that candidates may confuse account suspension with SCP enforcement or security incidents, but AWS only suspends accounts for billing non-payment, not for policy violations or security events.

How to eliminate wrong answers

Option B is wrong because Service Control Policies (SCPs) do not cause account suspension; they only restrict permissions on accounts within an organization, and violations result in denied API calls, not account suspension. Option C is wrong because AWS does not suspend accounts due to security breaches; instead, it may notify the account owner or apply temporary restrictions, but suspension is reserved for billing non-payment. Option D is wrong because removing an account from an organization does not suspend it; the account becomes a standalone account and remains active, not suspended.

Practice this question →

368

MCQmedium

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

A.Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.

B.Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.

C.Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.

D.Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.

AnswerC

Organization trails deliver logs from all accounts to a single bucket.

Why this answer

AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

Exam trap

The trap here is that candidates often assume they need to configure CloudTrail in each account individually or use cross-account IAM roles to copy logs, but AWS Organizations provides a native organization trail feature that automatically aggregates logs from all accounts into a single S3 bucket in a centralized logging account.

How to eliminate wrong answers

Option A is wrong because it introduces unnecessary complexity and latency by requiring an IAM role in each account and a scheduled Lambda function to copy logs hourly, which is not real-time and violates the principle of least privilege by granting cross-account copy permissions. Option B is wrong because CloudTrail does not support delivering logs to an S3 bucket in a different account using a bucket policy that grants read/write access to all accounts; CloudTrail requires the destination bucket to be in the same account as the trail or uses an organization trail with a bucket policy that grants CloudTrail service principal write access, not all accounts. Option D is wrong because AWS Config streams configuration history and changes, not CloudTrail logs, and it does not aggregate CloudTrail API activity logs; it serves a different purpose for compliance and resource tracking.

Practice this question →

369

MCQmedium

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

A.Set up Amazon EventBridge to forward findings from each account to the central account.

B.Use Amazon CloudWatch cross-account dashboards to view findings.

C.Enable AWS Config aggregator in the central account.

D.Enable Security Hub in the central account and invite member accounts to enable Security Hub.

AnswerD

This is the standard way to aggregate findings in Security Hub.

Why this answer

AWS Security Hub uses a multi-account architecture where a central administrator account invites member accounts to enable Security Hub. This allows the administrator account to aggregate findings, insights, and compliance scores from all member accounts into a single view, enabling centralized security monitoring without additional forwarding infrastructure.

Exam trap

The trap here is that candidates confuse Security Hub's multi-account model with other aggregation services like AWS Config aggregator or CloudWatch cross-account dashboards, assuming any cross-account aggregation tool can consolidate Security Hub findings, when in fact Security Hub requires its own dedicated multi-account feature.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge can forward events but is not the native mechanism for Security Hub multi-account aggregation; Security Hub uses its own invitation-based model, and EventBridge would require custom event buses and rules, adding unnecessary complexity and missing native cross-account finding consolidation. Option B is wrong because Amazon CloudWatch cross-account dashboards aggregate metrics and logs, not Security Hub findings; Security Hub findings are not stored in CloudWatch Logs or Metrics by default, so dashboards cannot display them. Option C is wrong because AWS Config aggregator aggregates AWS Config rules and compliance data across accounts, not Security Hub findings; Security Hub findings are separate from AWS Config and require Security Hub's own multi-account enablement.

Practice this question →

370

MCQhard

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

A.Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.

B.Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.

C.Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.

D.Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.

AnswerC

Resolver endpoints enable cross-account DNS resolution.

Why this answer

It uses Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account's private hosted zone, enabling centralized management of DNS records across accounts. This approach provides high availability and supports cross-account DNS resolution.

Exam trap

The trap here is that candidates often confuse Route 53 Resolver rules (which forward queries to a target) with the need for both inbound and outbound endpoints to enable cross-account DNS resolution, leading them to choose Option A which lacks the necessary endpoint infrastructure.

How to eliminate wrong answers

Option A is wrong because Route 53 Resolver rules forward queries to a target IP address, but they do not inherently support cross-account private hosted zone resolution without additional infrastructure like inbound/outbound endpoints. Option B is wrong because creating private hosted zones in each account defeats centralized management, and inbound endpoints in the central account only accept queries, not forward them to other accounts' zones. Option D is wrong because Route 53 zone sharing is not supported for private hosted zones; it only applies to public hosted zones and does not enable cross-account DNS resolution.

Practice this question →

371

MCQhard

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

A.Use AWS Config rules to detect and automatically delete any new users or keys.

B.Enable AWS CloudTrail and create a metric filter to alert on these actions.

C.Attach an IAM policy to the Administrator role in each account that denies these actions.

D.Apply a service control policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions.

AnswerD

SCPs apply to all principals in the account.

Why this answer

Service control policies (SCPs) are the most scalable way to enforce restrictions across all accounts in an AWS Organization because they apply to all IAM users and roles in every member account, including the root user. By denying the iam:CreateUser and iam:CreateAccessKey actions at the organization root or OU level, the security team can prevent any IAM user from creating new users or access keys without needing to manage individual account policies or rely on reactive measures.

Exam trap

The trap here is that candidates often choose Option C because they think attaching a deny policy to the Administrator role is sufficient, but they overlook that SCPs are the only mechanism that can restrict the root user and scale across hundreds of accounts without per-account management.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive—they detect non-compliant resources after creation and can trigger auto-remediation, but they do not prevent the action from occurring, leaving a window where the user or key exists and could be used. Option B is wrong because CloudTrail with metric filters and alerts only provides notification after the fact; it does not block the action, so the security violation still occurs. Option C is wrong because attaching an IAM policy to the Administrator role in each account is not scalable for hundreds of accounts—it requires manual per-account configuration and does not prevent actions by the root user or other roles that might bypass the policy.

Practice this question →

372

Multi-Selecthard

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Select 3 answers

A.Create a private hosted zone in the central networking account.

B.Share the private hosted zone with other accounts using AWS Resource Access Manager.

C.Create a public hosted zone with the same name and configure DNSSEC.

D.Associate the private hosted zone with the VPCs in the member accounts.

E.Create a Route 53 Resolver outbound endpoint in each account.

AnswersA, B, D

Central account holds the zone.

Why this answer

A private hosted zone must be created in a central networking account to serve as the authoritative DNS namespace for the organization's internal resources. This central account acts as the zone owner, allowing the zone to be associated with VPCs across multiple accounts via AWS Resource Access Manager (RAM).

Exam trap

The trap here is that candidates often confuse the need for a public hosted zone or outbound endpoints with the simpler mechanism of sharing a private hosted zone via AWS RAM and associating it with VPCs, leading them to select unnecessary or incorrect options.

Practice this question →

373

MCQmedium

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?

A.Federate using SAML 2.0 with on-premises ADFS and map AD groups to IAM roles.

B.Deploy AD Connector in each VPC to proxy authentication requests to on-premises Active Directory.

C.Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.

D.Use AWS Directory Service Simple AD and synchronize with on-premises Active Directory using AD Connector.

AnswerC

AWS Managed Microsoft AD supports trust relationships and can be used for IAM authentication.

Why this answer

AWS Managed Microsoft AD can establish a forest trust with an on-premises Active Directory, allowing users to authenticate using their existing corporate credentials. This approach is secure (Kerberos-based trust, no password exposure) and scalable (AWS handles AD infrastructure). IAM roles can then be mapped to AD groups via SAML or IAM Identity Center for fine-grained access to AWS resources.

Exam trap

The trap here is that candidates often confuse AD Connector (a proxy) with a trust relationship, thinking it provides the same level of integration, but AD Connector does not support native Kerberos trusts or scalable authentication for AWS Managed Microsoft AD migration.

How to eliminate wrong answers

Option A is wrong because federating with SAML 2.0 and ADFS requires maintaining a separate federation infrastructure and does not directly integrate with AWS Managed Microsoft AD for native AD authentication; it also adds complexity without leveraging the trust relationship. Option B is wrong because AD Connector is a proxy that forwards authentication requests to on-premises AD, but it does not provide a scalable solution for migrating to AWS Managed Microsoft AD and introduces a single point of failure in each VPC. Option D is wrong because Simple AD is a standalone LDAP directory based on Samba 4, not compatible with Active Directory trusts or Kerberos authentication, and AD Connector cannot synchronize with Simple AD; it only proxies to on-premises AD.

Practice this question →

374

MCQhard

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

A.Full access to all AWS services because no SCP is applied to the DevAccount.

B.Nothing, because the management account's SCP applies to all accounts.

C.Only read-only actions because of default SCP.

D.Only actions allowed by the root user's implicit full access.

AnswerB

As explained above: the management account's SCP applies to all accounts in the organization, denying all actions.

Why this answer

SCPs are inherited from the root of the organization. The management account (111111111111) has an SCP that denies all actions, and since the DevAccount (222222222222) is a member of the same AWS Organization, this SCP applies to all accounts in the organization, including the DevAccount. Therefore, the root user of the DevAccount is denied all actions, even though no SCP is explicitly attached to the DevAccount.

Exam trap

The trap is that candidates assume that because the DevAccount has no SCP attached, the root user has full access. However, SCPs are inherited from the root OU, and the management account's SCP denying all actions applies to all accounts in the organization, including the DevAccount.

How to eliminate wrong answers

Option B is wrong because SCPs only apply to accounts that are members of the same AWS Organization; the management account's SCP does not automatically apply to accounts outside its organization, and the DevAccount is not stated to be a member. Option C is wrong because there is no 'default SCP' that enforces read-only actions; when no SCP is attached, the default behavior is to allow all actions (full access). Option D is wrong because the root user's implicit full access is not limited by any SCP in this scenario, so the root user can perform all actions, not just those allowed by implicit full access (which is already full access).

Practice this question →

375

MCQhard

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

A.Create an AWS Service Catalog portfolio that restricts bucket creation to encrypted buckets only.

B.Use IAM policies in each account to deny PutBucketEncryption actions that do not specify the required KMS key.

C.Enable AWS CloudTrail and create a CloudWatch Events rule to automatically remediate non-compliant buckets.

D.Apply an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key, and use AWS Config rules to detect and remediate existing non-compliant buckets.

AnswerD

SCPs can deny actions organization-wide, and AWS Config rules can detect and remediate non-compliant buckets.

Why this answer

SCPs can deny the creation of S3 buckets without encryption or with the wrong KMS key, and AWS Config rules can detect non-compliant existing buckets for remediation. Option A is wrong because AWS Service Catalog is not designed for this purpose. Option B is wrong because IAM policies alone cannot enforce encryption at the organizational level across multiple accounts.

Option C is wrong because AWS CloudTrail only logs, not enforces.

Practice this question →